A bug was identified in the Linux kernel’s btrfs subsystem, specifically the scrub_print_warning_inode() function. When the helper paths_from_inode() fails during path resolution, the function jumps to an error handler without releasing a reference that was previously taken by btrfs_get_fs_root(). This causes a reference count to remain incremented for the filesystem root each time such a failure occurs. Over time, the accumulation of unreleased references can exhaust kernel resources, potentially leading to memory pressure and denial of service. No other error pathways in the function release the reference, making this a selective leak.

The vulnerability impacts the Linux kernel, affecting all installations that use the btrfs file system. No specific kernel releases were enumerated in the advisory, so all current and future releases that contain the unpatched code are potentially affected.

The CVSS score and EPSS metric are not provided, and the vulnerability is not listed in CISA’s KEV catalog, indicating that it has not been widely exploited or observed in the wild. The attack vector is likely a local or privileged system interaction that triggers the scrub operation or causes path resolution failures during scrub warnings. Because the issue manifests during normal scrub activity, it could be triggered by legitimate usage under certain failure conditions, but no public exploit is known. The risk is considered moderate: if an attacker can repeatedly trigger scrub failures, resource exhaustion could occur, but requiring kernel-level access or system compromise to do so. Existing mitigations include applying a kernel update that resolves the reference leak.